229 matches found
Image Gallery with Access Database - 'dispimage.asp?id' SQL Injection
source: https://www.securityfocus.com/bid/21131/info Image gallery with Access Database is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allow an attacker to compromise th...
CVE-2006-1011
LetterMerger 1.2 stores user information in Access database files with insecure permissions, which allows local users to obtain sensitive information. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...
Information disclosure
LetterMerger 1.2 stores user information in Access database files with insecure permissions, which allows local users to obtain sensitive information. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...
CVE-2006-1011
LetterMerger 1.2 stores user information in Access database files with insecure permissions, allowing local users to obtain sensitive data. Root cause: improper access control on the database files. Impact: potential information disclosure for local attackers. Public references note this is a low...
Echo Security Advisory 2005.21
--------------------------------------------------------------------------- ECHOADV21$2005 MUltiple Vulnarable In ActiveBuyAndSell --------------------------------------------------------------------------- Author: Dedi Dwianto Date: June, 24th 2005 Location: Indonesia, Jakarta Web:...
JGS-Portal 3.0.1 - 'ID' SQL Injection
source: https://www.securityfocus.com/bid/13451/info JGS-Portal is prone to an SQL injection. This issue may potentially be exploited to compromise the software or gain unauthorized access to the database. The consequences of exploitation will depend on the nature of the vulnerable SQL query and...
WebCalendar login.php webcalendar_session Cookie SQL Injection
The remote version of WebCalendar contains a SQL injection vulnerability that may allow an attacker to execute arbitrary SQL statements against the remote database. An attacker may be able to leverage this issue to, for example, delete arbitrary database tables. %NASLMINLEVEL 70300 C Tenable...
CVE-2004-2060
ASPRunner 2.4 stores the database under the web root in the db directory, which may allow remote attackers to obtain the database via a direct request to the database filename, which is predictable based on table and field names...
phpMyBackupPro < 1.0.0 Unspecified Input Validation Issues
The remote host seems to be using phpMyBackupPro. It is reported that the remote version of this software is prone to multiple security weaknesses regarding user input validation. An attacker may use these issues to gain access to the application or to access the underlying database. %NASLMINLEVE...
CVE-2004-0017
Multiple SQL injection vulnerabilities in the 1 calendar and 2 infolog modules for phpgroupware 0.9.14 allow remote attackers to perform unauthorized database operations...
MPCSoftWeb Guest Book vulnerabilities.
Date: 20.04.2003 Subject: MPCSoftWeb Guest Book vulnerabilities. Description: This Guest Book is designed to be easy to use and configure, it uses a Microsoft Access 2000 database to store the messages. It has a number of features: emoticons and text formatting, a profanity or unwanted word filte...
Web Wiz Forum 6.34 - Information Disclosure
Web Wiz Forum 6.34 - Information Disclosure source: https://www.securityfocus.com/bid/7380/info Web Wiz Forum has been reported prone to sensitive information disclosure vulnerability. An attacker may make a request for and download the underlying Access database file that is used by the Forum...
Web Wiz Forum 6.34 - Information Disclosure
source: https://www.securityfocus.com/bid/7380/info Web Wiz Forum has been reported prone to sensitive information disclosure vulnerability. An attacker may make a request for and download the underlying Access database file that is used by the Forum application. Sensitive information that is...
Web Wiz Site News 3.6 - Information Disclosure
Web Wiz Site News 3.6 - Information Disclosure source: https://www.securityfocus.com/bid/7341/info Web Wiz Site News has been reported prone to sensitive information disclosure vulnerability. An attacker may make a request for and download the underlying Access database file that is used by the...
Ocean12 ASP Guestbook Manager 1.0 - Information Disclosure
Ocean12 ASP Guestbook Manager 1.0 - Information Disclosure source: https://www.securityfocus.com/bid/7328/info Ocean12 Guestbook Manager has been reported prone to sensitive information disclosure vulnerability. An attacker may make a request for and download the underlying Access database file...
Ocean12 ASP Guestbook Manager 1.0 - Information Disclosure
source: https://www.securityfocus.com/bid/7328/info Ocean12 Guestbook Manager has been reported prone to sensitive information disclosure vulnerability. An attacker may make a request for and download the underlying Access database file that is used by the Guestbook Manager. Guestbook...
Sakki's guestbook V.1.01 script injection vulnerability.
This advisory can be found at www.blacktigerz.org. Description: Easy to manage and configure asp powered guestbook. Works with MS Access database or without it. Vendor: http://www.sakki.net Vulnerability: gb.asp neglects filtering user input allowing for script injection to the guestbook via "nam...
Microsoft Word Mail Merge vulnerability
Microsoft Word document merged with Access database allows to execute VBA procedures without warning...
CVE-2000-0788
The CVE-2000-0788 family concerns the Mail Merge Tool in Microsoft Word. Connected records describe Word 2000/Word 2002 behavior: when Access is present, the Mail Merge tool can execute Visual Basic (VBA) scripts embedded in a mail-merge document saved as HTML, enabling remote command execution. ...
3 phpnuke bugs (2 possibly lead to admin privs)
phpnuke www.phpnuke.org is an opensource webpage portal powers many websites on the net. Version 5.x of phpnuke does not properly check some variables, and is vulnerable to an attack that gives an intruder admin privileges. This is only possible if the intruder knows the database name that phpnuk...